As users' demands for an increasingly high rate of wireless access, there emerges the WLAN, which is able to provide high-rate wireless data access in a relatively small area. Various techniques have been used in WLAN, among which a technical standard with more applications is IEEE 802.11b. This standard involves the frequency band of 2.4 GHz with a data transmission rate up to 11 Mbps. Other technical standards involving the same frequency band include IEEE 802.11g and the Bluetooth, where the data transmission rate of IEEE 802.11g is up to 54 Mbps. There are other new standards such as IEEE 802.11a and ETSI BRAN Hiperlan2, which use the frequency band of 5 GHz with the transmission rate up to 54 Mbps as well.
Although there are various techniques for wireless access, most WLANs are utilized to transfer IP data packets. The specific WLAN access technique adopted by a wireless IP network is usually transparent to the upper IP layer. Such a network is usually configured with Access Points for providing wireless access to a user terminal and with controlling and connecting devices for implementing IP transmission.
Along with the rising and developing of WLAN, focus of research is shifting to the inter-working of WLAN with various mobile communications networks, such as GSM, CDMA, WCDMA, TD-SCDMA, and CDMA2000. In accordance with the 3GPP standards, a user terminal is able to connect to Internet and Intranet via the WLAN access network and also connect to a user's home network and visited networks of a 3GPP system via the WLAN access network. To be specific, when accessing locally, a WLAN user terminal will get connected to the 3GPP home network via the WLAN access network, as shown in FIG. 2; when roaming, it will get connected to the 3GPP visited network via the WLAN access network. Some entities of the 3GPP visited network are connected with corresponding entities of the 3GPP home network, for instance, the 3GPP Authentication, Authorization and Accounting (AAA) Proxy in the visited network is connected with the 3GPP AAA Server in the home network, the WLAN Access Gateway (WAG) in the visited network is connected with the Packet Data Gateway (PDG) in the home network, as shown in FIG. 1. FIG. 1 and FIG. 2 are the schematic diagrams illustrating the networking architectures of a WLAN inter-working with a 3GPP system with and without roaming facilities, respectively.
As shown in FIG. 1 and FIG. 2, a 3GPP system primarily comprises Home Subscriber Server (HSS)/Home Location Register (HLR), 3GPP AAA Server, 3GPP AAA Proxy, WAG, PDG, Offline Charging System and Online Charging System (OCS). User terminals, WLAN access network, and all the entities of the 3GPP system together constitute a 3GPP-WLAN inter-working network, which can be used as a WLAN service system. In this service system, 3GPP AAA Server is in charge of the authentication, authorization and accounting of a user, collecting the charging information sent from the WLAN access network and transferring the information to the charging system; PDG is in charge of the transmission of the user's data from the WLAN access network to the 3GPP network or other packet networks; and the charging system receives and records the subscribers' charging information transferred from the network. OCS instructs the network transmit the online charging information periodically in accordance with the expense state of the online charged subscribers and makes statistics and conducts control.
In the non-roaming case, when a WLAN user terminal desires to access directly the Internet/Intranet, the user terminal can access Internet/Intranet via WLAN access network after it passes authentication and authorization of AAA server (AS) via WLAN access network. If the WLAN user terminal desire to access services of 3GPP packet switching (PS) domain as well, it may further request the services of Scenario 3 from the 3GPP home network. That is, the WLAN user terminal initiates a authorization request for the services of Scenario 3 to the AS of the 3GPP home network, which will carry out service authentication and authorization for that request; if it succeeds, AS will send an access accept message to the user terminal and assign a corresponding PDG for the user terminal. When a tunnel is established between the user terminal and the assigned PDG, the user terminal will be able to access to the services of the 3GPP PS domain. Meanwhile, the offline charging system and OCS records the charging information in accordance with the user terminal's occupation of network resources. In the roaming case, when a WLAN user terminal desires to access directly the Internet/Intranet, it may make a request to the 3GPP home network by way of the 3GPP visited network for access to the Internet/Intranet. If the user terminal also desires to request the services of Scenario 3 to access the services of the 3GPP PS domain, the user terminal needs to initiate via the 3GPP visited network a service authorization process at the 3GPP home network. The authorization is carried out likewise between the user terminal and AS of the 3GPP home network. After the authorization succeeds, AS assigns the corresponding home PDG for the user terminal, then the user terminal will be able to access the services of 3GPP PS domain of the home network after it establishes a tunnel with the assigned PDG via the WAG of the 3GPP visited network.
At present, after a user selects an Access Point Name (APN) of a service, there are two implementing schemes to obtain the address of corresponding service providing unit according to the service name after authentication and authorization of the AAA server:
One scheme is: the user terminal directly obtains the address of final service providing unit, namely destination PDG address, through a public Domain Name Server (DNS), wherein the destination PDG is usually located in home network of current user terminal. In this case, user terminal sends a tunnel establishing request to the destination PDG, the PDG authenticates current user terminal on AAA server after receiving the request. If the authentication is successful, the destination PDG directly establishes a tunnel between itself and User Terminal (UE). Disadvantage of this scheme lies in: it is difficult for visited network to judge whether to allow the user to visit destination address and make control, so that illegal data may be transmitted among networks. Because inter-network traffic is usually long-distance traffic, transmission cost is pretty high and inter-network balance is required. Therefore, it's better to avoid transmitting unauthenticated information. In addition, in terms of security, if all PDGs in a network of an operator are exposed in DNS system and any Internet users can get them, there will be great potential trouble for network security.
The other scheme is: the user terminal obtains through by private DNS resolving the WAG which covers it currently and service authentication and authorization is performed through interaction between the WAG and AAA server. After the authorization is successful, the WAG obtains the address of final service providing unit from AAA server, namely address of PDG, and then current user terminal sends a tunnel establishing request to the destination PDG to establish a tunnel between UE and destination PDG. However, as a user's request is directly handled by WAG in this scheme, a WAG detecting mechanism, like DNS or DHCP, is needed to inquire and resolve WAG's address, accordingly new protocol needs to be added for interaction. Besides, since there is repeated interaction between PDG and AAA server for APN authentication and authorization, this scheme through WAG becomes more complicated. Moreover, there are much more WAGs than PDGs in a visited network. All this leads to a greater demand for WAG in the visited network, which has to provide sufficient WAGs so as to guarantee the service interaction. What's more, as a large number of WAGs in other networks will interact with AAA server, the core device in the home network, a great threat is posed for the security of AAA server, thus bringing difficulty to the roaming of services.
Therefore, there are obvious disadvantages in the above two schemes, so it is difficult to put them into use. The main reason is that neither of the schemes adopts proper resolution strategy according to different capabilities of visited networks. In one scheme, the visited network is required to have strong capability, leading to problems like complicated network implementation and potential trouble for inter-network security, so that roaming scope is restricted. With the other scheme, although public DNS resolution is pretty easy, inter-network data cannot be effectively controlled and public DNS must be relied on, which brings potential security problem and consequently confines the application of this scheme.